engineering-advanced-skills

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: A static analysis alert for 'Ignore previous instructions' was triggered in skill-security-auditor/SKILL.md. This is a false positive as the skill is a security tool documenting patterns it is designed to detect and flag as critical threats, rather than an attempt to bypass agent safeguards.
  • [COMMAND_EXECUTION]: Several skills (e.g., autoresearch-agent, agenthub, mcp-server-builder) utilize local Python scripts located in the scripts/ directory to perform automation tasks. These include:
  • setup_experiment.py and run_experiment.py for autonomous code optimization.
  • dag_analyzer.py and session_manager.py for multi-agent coordination.
  • tf_security_scanner.py and chart_analyzer.py for infrastructure auditing.
  • These operations are the primary intended purpose of these specialized engineering tools.
  • [EXTERNAL_DOWNLOADS]: The autoresearch-agent and helm-chart-builder skills provide installation instructions to clone a repository from github.com/alirezarezvani/claude-skills.git. This is the source repository for the tools being described and is a standard procedure for skill installation.
  • [INDIRECT_PROMPT_INJECTION]: Skills such as pr-review-expert and data-quality-auditor ingest external data (code diffs and CSV datasets) for analysis. While this presents a potential ingestion surface, the primary purpose of these skills is professional auditing, and the instructions emphasize validation and verification.
  • [PERSISTENCE]: The autoresearch-agent utilizes the platform's CronCreate capability to execute autonomous loops for code optimization. This is a documented feature of the skill designed to allow experiments to run over extended periods without constant user supervision.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 12:14 PM